Description
SSH2 clients for VanDyke (1) SecureCRT 4.0.2 and 3.4.7, (2) SecureFX 2.1.2 and 2.0.4, and (3) Entunnel 1.0.2 and earlier, do not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
References
- 20030129 iDEFENSE Security Advisory 01.28.03: SSH2 Clients Insecurely Store Passwords mailing-list
- 6727 vdb-entry
- 6728 vdb-entry
- 1006011 vdb-entry
- 1006010 vdb-entry
- 1006012 vdb-entry
- http://www.idefense.com/advisory/01.28.03.txt
- 6726 vdb-entry